ci: harden gating workflows for branch-protection consumers (#289) #1581
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI - Static Analysis (C Code) | |
| on: | |
| push: | |
| branches: [ main, develop, 'feature/**', 'fix/**' ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| permissions: | |
| contents: read | |
| security-events: write # Required for CodeQL SARIF upload | |
| # Collapse overlapping runs on the same ref; main is preserved. | |
| concurrency: | |
| group: static-analysis-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.event_name != 'schedule' }} | |
| jobs: | |
| cppcheck: | |
| name: Cppcheck Static Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install cppcheck | |
| run: | | |
| sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true | |
| sudo apt-get update | |
| sudo apt-get install -y cppcheck | |
| - name: Run cppcheck on C sources | |
| run: | | |
| cppcheck \ | |
| --enable=warning,style,performance,portability \ | |
| --suppress=missingIncludeSystem \ | |
| --suppress=unusedFunction \ | |
| --error-exitcode=1 \ | |
| --inline-suppr \ | |
| --std=c11 \ | |
| -I include/ \ | |
| -DAMA_USE_NATIVE_PQC \ | |
| --force \ | |
| -i src/c/vendor/ \ | |
| src/c/ 2>&1 | tee cppcheck-report.txt | |
| - name: Upload cppcheck report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: cppcheck-report | |
| path: cppcheck-report.txt | |
| retention-days: 30 | |
| clang-analyzer: | |
| name: Clang Static Analyzer (scan-build) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install dependencies | |
| run: | | |
| sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true | |
| sudo apt-get update | |
| sudo apt-get install -y cmake clang clang-tools | |
| - name: Run scan-build | |
| run: | | |
| mkdir -p build-scan | |
| cd build-scan | |
| scan-build --status-bugs \ | |
| -enable-checker security.FloatLoopCounter \ | |
| -enable-checker security.insecureAPI.UncheckedReturn \ | |
| -enable-checker alpha.security.ArrayBoundV2 \ | |
| -enable-checker alpha.security.MallocOverflow \ | |
| -enable-checker alpha.security.ReturnPtrRange \ | |
| -enable-checker alpha.security.taint.TaintPropagation \ | |
| cmake .. \ | |
| -DCMAKE_C_COMPILER=clang \ | |
| -DAMA_USE_NATIVE_PQC=ON \ | |
| -DAMA_BUILD_TESTS=OFF \ | |
| -DAMA_BUILD_EXAMPLES=OFF \ | |
| -DAMA_ENABLE_LTO=OFF | |
| scan-build --status-bugs \ | |
| -enable-checker security.FloatLoopCounter \ | |
| -enable-checker security.insecureAPI.UncheckedReturn \ | |
| -enable-checker alpha.security.ArrayBoundV2 \ | |
| -enable-checker alpha.security.MallocOverflow \ | |
| -enable-checker alpha.security.ReturnPtrRange \ | |
| -enable-checker alpha.security.taint.TaintPropagation \ | |
| make -j$(nproc) | |
| - name: Upload scan-build report | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scan-build-report | |
| path: /tmp/scan-build-* | |
| retention-days: 30 | |
| codeql: | |
| name: CodeQL Security Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 | |
| with: | |
| languages: c-cpp, python | |
| queries: security-and-quality | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Build C library for CodeQL | |
| run: | | |
| cmake -B build \ | |
| -DAMA_USE_NATIVE_PQC=ON \ | |
| -DAMA_BUILD_TESTS=OFF \ | |
| -DAMA_BUILD_EXAMPLES=OFF \ | |
| -DAMA_ENABLE_LTO=OFF | |
| cmake --build build -j$(nproc) | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 | |
| with: | |
| category: "/language:c-cpp" | |
| compiler-warnings: | |
| name: Strict Compiler Warnings | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| compiler: [gcc, clang] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install dependencies | |
| run: | | |
| sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true | |
| sudo apt-get update | |
| sudo apt-get install -y cmake ${{ matrix.compiler }} | |
| - name: Build with strict warnings (Werror) | |
| run: | | |
| cmake -B build-strict \ | |
| -DCMAKE_C_COMPILER=${{ matrix.compiler }} \ | |
| -DCMAKE_C_FLAGS="-Wall -Wextra -Wpedantic -Wshadow -Wformat=2 -Wconversion -Wno-sign-conversion" \ | |
| -DAMA_USE_NATIVE_PQC=ON \ | |
| -DAMA_BUILD_TESTS=ON \ | |
| -DAMA_BUILD_EXAMPLES=OFF \ | |
| -DAMA_ENABLE_LTO=OFF | |
| cmake --build build-strict -j$(nproc) | |
| - name: Run tests | |
| run: cd build-strict && ctest --output-on-failure | |
| version-consistency: | |
| # Enforces audit 5a: every file that declares the library version must | |
| # agree with ama_cryptography/__init__.py. Also enforces audit 6a: | |
| # root INVARIANTS.md must stay byte-identical to .github/INVARIANTS.md | |
| # — we inlined the full content to eliminate the dead-pointer stub, so | |
| # CI now fails if a future edit touches only one copy. | |
| name: Version / Invariants Consistency | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Run version consistency check | |
| run: python3 tools/check_version_consistency.py | |
| address-sanitizer: | |
| name: AddressSanitizer + UBSan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install dependencies | |
| run: | | |
| sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true | |
| sudo apt-get update | |
| sudo apt-get install -y cmake clang | |
| - name: Build with ASan + UBSan | |
| run: | | |
| cmake -B build-asan \ | |
| -DCMAKE_C_COMPILER=clang \ | |
| -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \ | |
| -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined" \ | |
| -DAMA_USE_NATIVE_PQC=ON \ | |
| -DAMA_BUILD_TESTS=ON \ | |
| -DAMA_BUILD_EXAMPLES=OFF \ | |
| -DAMA_ENABLE_LTO=OFF | |
| cmake --build build-asan -j$(nproc) | |
| - name: Run tests under sanitizers | |
| env: | |
| ASAN_OPTIONS: detect_leaks=1:detect_stack_use_after_return=1 | |
| UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1 | |
| run: cd build-asan && ctest --output-on-failure |